Topics

In the Postfix plugin the default value is 51200000 Bytes.

I know it follows the convention of the original documentation.

message_size_limit
(I linked via Wayback Machine as I don't know why the Postfix site is currently offline)

But does anybody know why that is?

I mean it is calculated as 50x1024x1000 = 51200000 Bytes.

Shouldn't it either be 50x1024x1024 = 52.428.800 Bytes or 50x1000x1000 = 50.000.000 Bytes?

I know the diference between KiB and KB, MiB and MB etc. but why is it a mixed case here?

Hi, I have a problem connecting our OPNsense with a FortiGate device.

Here is the IPsec log:

Code Select Expand

2026-02-25T15:00:59    Informational    charon    07[ENC] <353286> generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]   
2026-02-25T15:00:59    Informational    charon    07[CFG] <353286> no matching peer config found   
2026-02-25T15:00:59    Informational    charon    07[CFG] <353286> looking for peer configs matching 185.xxx.xx.xx[%any]...195.yyy.yyy.yyy[195.yyy.yyy.yyy]   
2026-02-25T15:00:59    Informational    charon    07[ENC] <353286> parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) AUTH N(MSG_ID_SYN_SUP) SA TSi TSr ]   
2026-02-25T15:00:59    Informational    charon    07[NET] <353286> received packet: from 195.yyy.yyy.yyy[500] to 185.xxx.xx.xx[500] (480 bytes)   
2026-02-25T15:00:59    Informational    charon    07[NET] <353286> sending packet: from 185.xxx.xx.xx[500] to 195.yyy.yyy.yyy[500] (456 bytes)   
2026-02-25T15:00:59    Informational    charon    07[ENC] <353286> generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]   
2026-02-25T15:00:59    Informational    charon    07[CFG] <353286> selected proposal: IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048   
2026-02-25T15:00:59    Informational    charon    07[IKE] <353286> 195.yyy.yyy.yyy is initiating an IKE_SA   
2026-02-25T15:00:59    Informational    charon    07[ENC] <353286> parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]   
2026-02-25T15:00:59    Informational    charon    07[NET] <353286> received packet: from 195.yyy.yyy.yyy[500] to 185.xxx.xx.xx[500] (672 bytes)   
2026-02-25T15:00:58    Informational    charon    09[NET] <353285> sending packet: from 185.xxx.xx.xx[500] to 195.yyy.yyy.yyy[500] (80 bytes)
IKE IDs are set on both sides and proposals are on default on both sides. Any suggestion?

There is already an old working IKEv1 connection to the same peer with a different firewall (Sophos Astaro) so there won't a be firewall issue.

But I wonder why the line with "looking for peer configs matching" says "[%any]" for the IKE ID when I specifically provided that. Could that prevent OPNsense from finding the Pre-Shared Key combination in the list?

I now added a screenshot which states "When left empty %any is chosen as default" yet it still shows "%any" in the log despite a defined local IP address, is this a bug?

We use DNSCrypt-Proxy instead of Unbound so it would be nice if we could also use the Q-Feeds blocklist there.

Maybe you are also in the process of hardening your Active Directory.

When you activate LDAP Signing on the domain controller this might break the OpenVPN connections for your users if you have configured LDAP connections to your DC via simple binds.

Sample error message in the OpenVPN Connect client:

Code Select Expand

⏎[Aug 20, 2025, 08:55:52] AUTH_FAILED
⏎[Aug 20, 2025, 08:55:52] EVENT: AUTH_FAILED ⏎[Aug 20, 2025, 08:55:52] EVENT: DISCONNECTED ⏎
The server log is more detailed and shows:

Code Select Expand

2025-08-20T08:55:52 Warning openvpn user 'ACME_HANNEBAMBEL' could not authenticate.
2025-08-20T08:55:52 Error openvpn LDAP bind error [00002028: LdapErr: DSID-0C090330, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v4f7c; Strong(er) authentication required]

Because LDAP Signing seems to be a Microsoft specific thing, see also LDAP Wiki we need to upgrade the connection from LDAP to LDAPS.

You need these prerequisites in the OPNsense configuration before you should enable LDAP Signing on your DC so you won't break your OpenVPN connections (which are using OpenLDAP for authentication).

1. (Self-signed) CA root certificate from the DC copied to "System: Trust: Authorities" on OPNsense ("Import an existing Certificate Authority").

Tutorials how to create a CA root certificate on the DC (without the server role "Active Directory Certificate Services") can be found here:

https://gist.github.com/magnetikonline/0ccdabfec58eb1929c997d22e7341e45
https://schweigerstechblog.de/ldaps-ohne-windows-ca-aktivieren-microsoft/ (German)

Make sure the private key is not of the type "BEGIN ENCRYPTED PRIVATE KEY" because then you will get the following error in OPNsense:

You cannot view this attachment.

("Invalid private key provided")

You can decrypt the key in OpenSSL like this (it will ask for the password):

Code Select Expand

openssl rsa -in ca.key -out ca_plain.key
If you forget to add the CA certificate you will get this error when you test your credentials:

You cannot view this attachment.

("error: error:0A000086:SSL routines::certificate verify failed (unable to get local issuer certificate")

2. Modify the existing server in "System: Access: Servers" to use either "StartTLS" or "SSL - Encrypted" instead of "TCP - Standard" in "Transport".

You cannot view this attachment.

3. Make sure you are using the FQDN of the DC as the hostname instead of an IP address. Otherwise you will get the following error when you test your credentials:

You cannot view this attachment.

("error: TLS: hostname does not match name in peer certificate")

[OpenVPN]

Lately when I updated from OPNsense 24.4.3 to 24.10.2 I also tried to switch from "VPN: OpenVPN: Servers [legacy]" to the new "VPN: OpenVPN: Instances" but I had to cancel that because of an error in the OpenVPN log:

Code Select Expand

Options error: --local addresses must be distinct from --ifconfig addresses
So I used the first address of the OpenVPN pool as "Bind address" which probably was wrong and is a bind to a physical interface and not to a new virtual interface (ovpns2)?

OpenVPN	OPNsense legacy	OPNsense Instances (new)
--ifconfig	"Interface"	"Bind address"
--local	"IPv4 Tunnel Network"	"Server (IPv4)"
--route	"IPv4 Local Network"	"Local Network"
--remote	"IPv4 Remote Network"	"Remote Network"

Is the assignment of the above table correct (Road Warrior setup)? If yes then why does the new "Instances" not have a multi-select field for existing interfaces like the old one did?

Hallo zusammen,

gibt es im System Aliase für die externe IP von OpenVPN-Benutzern, so, dass man diese in Firewall-Regeln verwenden kann?

Die Zuordnung gibt es ja bereits im System, siehe im Dashboard die Liste von verbundenen Benutzern:

You cannot view this attachment.

Hello everyone,

I just noticed high inblock packet counts on LAN interfaces which just act as parent interfaces for VLAN interfaces.

How can these high packet numbers be explained, are they originating from the attached switch?

130-200m seem to be a lot of packets per second.

I know the underlying real physical interface of a VLAN does not have to be enabled for a VLAN to be working but I had problems with a WiFi controller and enabling the interface solved it.

The LAN interfaces have the configuration type "none". What would fix these high packet counts without disabling the underlying LAN interfaces?

For comparison I'll show the packet counts of a normal active "Static IPv4" LAN interface vs. a passive LAN interface.

I just noticed our GeoIP database never updated since the beginning. Version is OPNsense 24.4.3-amd64.

Is it only updated if there is actually a rule using a GeoIP alias?

I've not used this feature before but I'm planning to.

Documentation says if the "Url" field in "Firewall: Aliases: GeoIP settings" is empty in the Business Edition it will download the database from the OPNsense servers.

Hallo zusammen,

die IPSec-Verbindungen funktionieren eigentlich wie gewollt.

Nur wenn man redundante Leitungen hinzufügt, kommt OPNsense wohl mit den IDs durcheinander?

Ist die Vorgehensweise wie im Screenshot gezeigt korrekt?

Lokale Seite hat 2 Internetleitungen und die entfernte Seite hat 2 Internetleitungen, also Redundanz auf beiden Seiten.

Ich gehe davon aus, dass die Rounds nacheinander abgearbeitet werden, also wenn Round 0 fehlschlägt, wird Round 1 durchfgeführt usw., oder sehe ich das falsch?

Die Gegenseite ist eine Sophos UTM, dessen Internetleitung 1 ist übrigens gerade tot, Bagger an Glasfaser ;D.

Hier ist der Log von der OPNsense:

Code Select Expand

2023-09-14T14:38:34 Informational charon 10[ENC] <2325> generating INFORMATIONAL_V1 request 3229602726 [ HASH N(AUTH_FAILED) ]
2023-09-14T14:38:34 Informational charon 10[IKE] <2325> no peer config found
2023-09-14T14:38:34 Informational charon 10[CFG] <2325> looking for pre-shared key peer configs matching xx.xx.67.42...xx.xx.179.218[xx.xx.179.218]
2023-09-14T14:38:34 Informational charon 10[ENC] <2325> parsed ID_PROT request 0 [ ID HASH ]
2023-09-14T14:38:34 Informational charon 10[NET] <2325> received packet: from xx.xx.179.218[500] to xx.xx.67.42[500] (108 bytes)
2023-09-14T14:38:33 Informational charon 10[NET] <2325> sending packet: from xx.xx.67.42[500] to xx.xx.179.218[500] (460 bytes)

What is your current BIOS and BMC firmware version for this mainboard?

Current:

BIOS: 1.4 (01/29/2021)
BMC: 03.88 (02/21/2020)

Latest:

BIOS: 1.7a (10/13/2022)
BMC: 03.95 (12/23/2021)

Has anybody updated these firmwares to the latest versions?

Were there any problems with OPNsense?

I know you need to purchase an Out of Band (OOB) Software License Key to be even able to update the BIOS from the GUI.

You may know the Network Connectivity Status Indicator (NCSI) in Windows which checks if you're connected to the Internet (shows a globe with prohibition sign when not connected).

It's all described here: https://learn.microsoft.com/en-us/windows-server/networking/ncsi/ncsi-frequently-asked-questions

Well, one of the active probes is a DNS query to "dns.msftncsi.com". Strangely the IPv6 address the DNS server resolves to is the unique local address (ULA) fd3e:4f5a:5b81::1, the equivalent of a private address in IPv4.

And that leads dnsmasq to log this DNS query as a rebind attack:

Code Select Expand

2023-07-21T08:10:00 Warning dnsmasq possible DNS-rebind attack detected: dns.msftncsi.com

Thanks to dave14305 at the OpenWRT forums for pointing that out: https://forum.openwrt.org/t/dns-rebind-attacks/150585/3

The funny thing is that in the Whois lookup of this address it states:

"remarks: This network should never be routed outside an enterprise"

https://findipv6.com/ipv6-whois/fd3e:4f5a:5b81::1

Microsoft is definitely an enterprise and the address is used outside of it.

So I created a group policy in the Windows domain to disable the active probing of NCSI. This reduced the amount of log entries but there are still PCs that are not in the domain.

https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetCommunicationManagement::NoActiveProbe

As there is no possibility to add a domain exception via the GUI I also created a feature request.

Hi there,

I have a problem with the monitoring of a satellite connection. It is a Viasat SurfBeam 2 modem.

The WAN4 interface gets its IP from a DHCP server of the SAT modem/router. Everything is working but the gateway is always shown as offline even when you see the RTT in the gateway overview.

For test purposes I already unchecked the options "Block private networks" and "Block bogon networks" in the WAN4 interface without an effect.

As you see all other WANs are monitored fine so I guess it's a weird problem in relation to the satellite modem.

Here is the packet capture of a ping to the DNS server which I use as the monitor IP (I also already tried the CloudFlare DNS 1.1.1.1, same result).

Code Select Expand


Interface Timestamp SRC DST output
WAN4
ix3 2023-07-05
12:43:26.873269 3c:ec:xx:xx:xx:xx 00:a0:xx:xx:xx:xx ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 7282, offset 0, flags [none], proto ICMP (1), length 28)
10.80.xxx.xx > 70.41.xx.x: ICMP echo request, id 6505, seq 481, length 8
WAN4
ix3 2023-07-05
12:43:27.453004 00:a0:xx:xx:xx:xx 3c:ec:xx:xx:xx:xx ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 55, id 18232, offset 0, flags [none], proto ICMP (1), length 28)
70.41.xxx.x > 10.80.xxx.xx: ICMP echo reply, id 6505, seq 481, length 8
WAN4
ix3 2023-07-05
12:43:31.980280 3c:ec:xx:xx:xx:xx 00:a0:xx:xx:xx:xx ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 63227, offset 0, flags [none], proto ICMP (1), length 28)
    10.80.xxx.xx > 70.41.xx.x: ICMP echo request, id 6505, seq 482, length 8
WAN4
ix3 2023-07-05
12:43:32.575468 00:a0:xx:xx:xx:xx 3c:ec:xx:xx:xx:xx ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 55, id 21553, offset 0, flags [none], proto ICMP (1), length 28)
70.41.xx.x > 10.80.xxx.xx: ICMP echo reply, id 6505, seq 482, length 8
WAN4
ix3 2023-07-05
12:43:36.982371 3c:ec:xx:xx:xx:xx 00:a0:xx:xx:xx:xx ethertype IPv4 (0x0800), length 42: (tos 0x0, ttl 64, id 43380, offset 0, flags [none], proto ICMP (1), length 28)
10.80.xxx.xx > 70.41.xx.x: ICMP echo request, id 6505, seq 483, length 8
WAN4
ix3 2023-07-05
12:43:37.571897 00:a0:xx:xx:xx:xx 3c:ec:xx:xx:xx:xx ethertype IPv4 (0x0800), length 60: (tos 0x0, ttl 55, id 24420, offset 0, flags [none], proto ICMP (1), length 28)
70.41.xx.x > 10.80.xxx.xx: ICMP echo reply, id 6505, seq 483, length 8


While writing I found the problem myself, I just had to increase the "Latency thresholds" from the default 200/500 range to 700/900 because the RTT of a satellite connection is so high. Maybe It helps somebody in the future. :D

1. Go to System->Settings->Plugins, search for "os-postfix" and install ith via the + sign on the right (in the screenshot it is already installed, that's why it shows a trash bin to remove it).



2. Refresh the Web GUI with F5 and you'll find "Postfix" under Services. Go to Services->Postfix->Domains and add your own domain, the field "Destination" is your Exchange Online target.



3. Go to senders and add your e-mail address which you want to send from, if you want to allow all e-mail addresses than just leave it empty.



4. Go to Services->Postfix->General and change "IP Version" to "IPv4" if you don't use IPv6. In "Trusted Networks" add your local subnet (in this case 192.168.3.0/24) or add single IPs for every allowed host. I don't know if the field "Smart Host" here is working at all, it had no effect if it was filled or empty. Maybe it just works with authentication which we don't need in this case.